luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

88pm860x_battery: Eliminate possible references to released resources

Browse Source 
devm_kzalloc should not be followed by kfree, as this results in a double
free.  The problem was found using the following semantic match
(http://coccinelle.lip6.fr/):

// <smpl>
@@
expression x,e;
@@
x = devm_kzalloc(...)
... when != x = e
?-kfree(x,...);
// </smpl>

Furthermore, in the remove function, the calls to free_irq are moved up to
prevent a possible reference in the interrupt handler to resources freed by
power_supply_unregister.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
This commit is contained in:
Julia Lawall 2013-01-06 12:46:23 -08:00 committed by Anton Vorontsov
parent 8feffd1099
commit 0853699252
1 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/power/88pm860x_battery.c
View File

@ -915,15 +915,13 @@ static int pm860x_battery_probe(struct platform_device *pdev)
info->irq_cc = platform_get_irq(pdev, 0);
if (info->irq_cc <= 0) {
dev_err(&pdev->dev, "No IRQ resource!\n");
ret = -EINVAL;
goto out;
return -EINVAL;
}
info->irq_batt = platform_get_irq(pdev, 1);
if (info->irq_batt <= 0) {
dev_err(&pdev->dev, "No IRQ resource!\n");
ret = -EINVAL;
goto out;
return -EINVAL;
}
info->chip = chip;
@ -957,7 +955,7 @@ static int pm860x_battery_probe(struct platform_device *pdev)
ret = power_supply_register(&pdev->dev, &info->battery);
if (ret)
goto out;
return ret;
info->battery.dev->parent = &pdev->dev;
ret = request_threaded_irq(info->irq_cc, NULL,
@ -984,8 +982,6 @@ static int pm860x_battery_probe(struct platform_device *pdev)
free_irq(info->irq_cc, info);
out_reg:
power_supply_unregister(&info->battery);
out:
kfree(info);
return ret;
}
@ -993,10 +989,9 @@ static int pm860x_battery_remove(struct platform_device *pdev)
{
struct pm860x_battery_info *info = platform_get_drvdata(pdev);
power_supply_unregister(&info->battery);
free_irq(info->irq_batt, info);
free_irq(info->irq_cc, info);
kfree(info);
power_supply_unregister(&info->battery);
platform_set_drvdata(pdev, NULL);
return 0;
}